Tensorlake npm Package Compromised by Shai-Hulud Worm

On October 8, 2026 the Tensorlake npm package (v0.5.144) was published from a compromised maintainer account containing a credential‑stealing worm named Shai‑Hulud. The malicious preinstall hook runs an obfuscated loader that harvests local and CI credentials, establishes persistence and attempts to propagate through connected supply chains; npm removed the package and affected users are advised to consider systems fully compromised and rotate credentials.